UPDATE 2 [December 26, 2016]: Michael Gillespie told Bleeping Computer that he found a way to recover files encrypted by the recent DeriaLock version that appends the .deria extension at the end of files. Victims should reach out to him via his Bleeping Computer profile or Twitter account.

UPDATE 3 [December 27, 2016]: Hahn detected a new DeriaLock version that threatens to delete a users’ files if he doesn’t pay the ransom and restarts his computer. The DeriaLock decrypter created by Gillespie still works.